NetSec-Analyst Practice Exam 4 — 20 Questions

Question 1

What happens if you delete an object that is currently in use by a Security Policy?

Accepted Answer

The system prevents the deletion until the reference is removed. PAN-OS prevents the deletion of an object if it is referenced by a policy, requiring the administrator to remove the reference first.

Answer

The policy is deleted

Answer

The policy is automatically disabled

Answer

The policy uses 'any' instead

Question 2

What is the 'Any' object?

Accepted Answer

A system-defined object representing all IP addresses. The 'Any' object is a pre-defined system object that represents all possible IP addresses and subnets.

Answer

A user-created object

Answer

An object for internal traffic only

Answer

An object that matches no traffic

Question 3

What is the 'Read-Only' state of an object indicating in SCM?

Accepted Answer

The object is inherited from a parent device group. An object is read-only if it is inherited from a parent device group, meaning it cannot be modified at the current level.

Answer

The administrator lacks permissions

Answer

The object is corrupted

Answer

The object is in use by a rule

Question 4

Which of the following are valid types of address objects? (Choose TWO)

Accepted Answer

IP Netmask. IP Netmask and FQDN are both standard address object types in PAN-OS.

Answer

Service Port

Answer

Application ID

Answer

Security Profile

Question 5

Which elements are required when creating a new custom Service Object? (Choose THREE)

Accepted Answer

Protocol. Service objects require a name, a protocol, and at least one port.

Answer

Tag

Answer

Description

Question 6

An administrator wants to prioritize VoIP traffic over all other traffic. Which policy type is the best choice?

Accepted Answer

QoS Policy. QoS policy allows classifying and prioritizing traffic based on class settings and interface bandwidth.

Answer

Security Policy

Answer

NAT Policy

Answer

Decryption Policy

Question 7

What happens if a packet matches multiple security policies?

Accepted Answer

It matches the first one in the list. The firewall evaluates policies from top to bottom and matches the first rule that criteria apply to.

Answer

It is dropped automatically

Answer

It matches the last one

Answer

It matches all of them

Question 8

Which TWO items are considered 'Objects' in the PAN-OS environment?

Accepted Answer

Service objects. Addresses, services, and application groups are all examples of objects that can be referenced in policies.

Answer

User names

Answer

Security zones

Answer

Policy rules

Question 9

When you use an Application Group in a policy, what happens if you add a new application to that group?

Accepted Answer

The policies using the group are updated automatically. Any security policy referencing that Application Group will automatically include the new application, improving policy agility.

Answer

The policy breaks

Answer

You must recreate the policy

Answer

You must re-save all policies

Question 10

An administrator notices high CPU usage on the management plane. Which command should be used to identify which process is causing the load?

Accepted Answer

show system resources. The 'show system resources' command provides a real-time view of CPU and memory utilization per process.

Answer

debug dataplane packet-diag

Answer

show system statistics

Answer

show system info

Question 11

What is the function of the 'Commit' operation regarding objects?

Accepted Answer

It pushes the configuration changes to the data plane. Objects created in the configuration are only active and enforced on the firewall after a 'Commit' is performed.

Answer

It deletes the object

Answer

It saves the object to the disk

Answer

It creates the object

Question 12

Which TWO methods can be used to identify traffic using App-ID when port-based rules are insufficient?

Accepted Answer

Behavioral analysis of the traffic flow.. App-ID relies on packet inspection and signature matching.

Answer

IP address reputation filtering.

Answer

MAC address filtering.

Answer

URL filtering categories.

Question 13

Which THREE conditions must be met for a NAT policy to be successfully applied to an incoming packet?

Accepted Answer

Source Zone match. NAT policy matches require a match on the source zone, destination zone, and destination address (or service) to correctly translate the packet.

Answer

QoS marking must be set

Answer

User-ID must be enabled

Question 14

Which THREE criteria are used to determine which security policy rule a packet matches?

Accepted Answer

Source Zone. The firewall matches packets based on source zone, destination zone, and source/destination addresses in a specific order defined in the policy base.

Answer

QoS class

Answer

NAT rule

Question 15

When configuring a QoS policy, what is the first step the administrator must take to ensure the traffic is correctly prioritized?

Accepted Answer

Enable QoS on the egress interface. Before QoS can be applied, the traffic must be identified and classified by the QoS policy based on the ingress interface and traffic matching criteria.

Answer

Create a new zone

Answer

Configure NAT policy

Answer

Delete all App-IDs

Question 16

When managing objects in SCM, which actions can be performed on tags? (Choose TWO)

Accepted Answer

Assigning a color. Tags can be assigned colors and applied to various objects for organization.

Answer

Defining an IP range

Answer

Defining a port protocol

Answer

Creating a security policy

Question 17

Which tab in the Palo Alto Networks GUI is primarily used to manage Security and NAT policies?

Accepted Answer

Policies. The 'Policies' tab is the central location for managing all types of policies.

Answer

Objects

Answer

Monitor

Answer

Network

Question 18

An administrator wants to group multiple existing FQDN Address Objects into a single logical container for easier policy management. Which object type should they use?

Accepted Answer

Static Address Group. Address Groups can contain FQDN objects to simplify policy rulebases.

Answer

Dynamic Address Group

Answer

Service Group

Answer

Region Object

Question 19

Which THREE steps are required to correctly implement User-ID mapping using the Windows-based User-ID agent?

Accepted Answer

Install the User-ID agent on a Windows server.. The agent must be installed, configured to monitor logs, and the firewall must be told to query the agent.

Answer

Install the GlobalProtect agent on all workstations.

Answer

Set the firewall to use a captive portal for all users.

Question 20

Which TWO items must be matched in a QoS policy?

Accepted Answer

Source Zone. QoS policies match on the Source/Destination zones, Source/Destination addresses, and the App-ID to determine the QoS class.

Answer

Security Profile

Answer

NAT Pool

Answer

User Group